Distributor Liability Contract Risk Management THOMAS DOUGLASS APRIL 15, 2015

Transcription

1 Distributor Liability Contract Risk Management THOMAS DOUGLASS APRIL 15, 2015

2 Today s Agenda What are we talking about today? What is Risk Evolution of risk management Understand the importance of Risk Transfer Key elements of contractual transfer The Interaction of contracts and insurance Newest topic in insurance Cyber Liability Questions & Answers

3 What is risk Risk is present in everything we do ISO 31000, the international standard on risk management, defines it this way: Risk = the effect of uncertainty on your objectives. Risk can be a threat or an opportunity Anything that could harm, prevent, delay or enhance your ability to achieve your objectives = risk 3

4 Why We Need to Manage Risk The purpose of managing risk is to increase the likelihood of an organization achieving its objectives by being in a position to manage threats and adverse situations and being ready to take advantage of opportunities that may arise. National Guidance on Implementing ISO 31000:2009 From NSAI in Ireland 4

5 5 Major Categories for External Global Risks Economic Risks Geopolitical Risks Environmental Risks Technological Risks Societal Risks 5

6 Top 5 Global Risks in Terms of Likelihood, : Insurance can help with most 6

7 Top 5 Global Risks in Terms of Impact, : Insurance can help with most 7

8 12 Industries with Risk Issues in the next 10 years Health Care Health Sciences Energy (Traditional) Alternative Energy Petrochemical Agriculture Natural Resources Technology (incl. Biotechnology) Light Manufacturing Insourced Manufacturing Export-Oriented Industries Shipping (Rail, Marine, Trucking, Pipelines) 8

9 A Few Definitions ISO Risk is the effect of uncertainty on objectives Risk Management, the coordinated activities to direct and control an organization with regard to risk Risk Owner, the person or entity with the accountability and authority to manage risk Stakeholder is any person or organization that can affect, be affected by or perceive themselves to be affected by a decision or activity. They are both internal and external. Stakeholders are important to the process and key to activities like communication, consultation and reporting. Stakeholders interests and fears should be taken into account Risk management process is the systematic application of management policies, procedures and practices to the tasks and activities of communicating, consulting, establishing the context and identifying, analyzing, evaluating, treating, monitoring and reviewing risk. 9

10 Risk Management is Evolving Transactional Approach Purchase insurance to cover risks Hazard-based risk identification and controls Compliance issues addressed separately Safety & emergency mgmt handled separately Silo approach risk mgmt is not integrated across the organization Risk Manager is the insurance buyer Risk is bad focus is on transferring risk A Broader Risk Mgmt Approach Greater use of alternative risk financing techniques More proactive about preventing and reducing risks Integrates claims mgmt, contracts review, special event RM, insurance and risk transfer techniques Cost allocation used for education and accountability More collaboration as depts. are willing Risk Manager may be the risk owner Risk is an expense focus is on reducing cost-of-risk Enterprise Risk Management A wide range of risks are discussed and reviewed, including reputational, human capital, strategic and operational Aligns RM process with strategy and mission May include upside risks (opportunities) Helps manage growth, allocate capital & resources Risks are owned by all & mitigated at the department level Many risk mitigation & analytical tools available Risk Manager is the risk facilitator and leader Risk is uncertainty focus is on optimizing risk to achieve goals 10

11 Why should we take a broader approach to risk? Insurance companies estimate that only 20-30% of all risks are insurable Global interconnectedness forces us to think more broadly for example: Pandemic flu Cyber attacks World economy & supply chain risks Now more than ever, we need all stakeholders to be risk aware 11

12 Principles Framework RM Process Creates value Integral part of organizational processes Part of decision making Explicitly addresses uncertainty Systematic, structured & timely Based on best available info Tailored Takes human & cultural factors into account Transparent & inclusive Dynamic, iterative & responsive to change Facilitates continual improvement & enhancement of the org Continually improve the framework Mandate & Commitment Design framework for managing risk Monitor and review the framework Implement risk management Communicate and consult Establish the context Risk assessment Risk identification Risk analysis Risk evaluation Risk treatment Monitor and review 12

13 Risk Identification - Contracts What are we committing to? What will our responsibilities be? Who will pay if something goes wrong? Where will the money come from? What other post-loss duties exist? Communicate and consult Establish the context Risk assessment Risk identification Risk analysis Risk evaluation Risk treatment Monitor and review 13

14 Risk Analysis - Contracts How important is this contract? Who are the key players? What s our timeframe? What s the loss history for these type of endeavors? How costly could it be? Communicate and consult Establish the context Risk assessment Risk identification Risk analysis Risk evaluation Risk treatment Monitor and review 14

15 Risk Evaluation - Contracts How important is this contract? What options do we have? What can we negotiate? What s the risk management perspective? Communicate and consult Establish the context Risk assessment Risk identification Risk analysis Risk evaluation Risk treatment Monitor and review What do we recommend? 15

16 Risk Treatment Making Choices Avoid it? Establish the context Control the risk? Share responsibility? What can we do to reduce the risk? Should we finance the risk? Communicate and consult Risk assessment Risk identification Risk analysis Risk evaluation Risk treatment Monitor and review Can we transfer the risk? 16

17 Options for Transferring Risk Insurance Bonds Through contractual risk transfer: Contracts + insurance requirements Indemnification agreements Hold harmless agreements Waivers 17

18 Minimum Scope of Insurance Coverages: Premises liability Products and completed operations Blanket contractual liability Personal injury with deletion of employee exclusion Named as additional insured Deletion of limitations re explosion, collapse, underground hazards Independent contractors Broad form property damages Limits: $500,000/occurrence combined single limit for bi/property damage? 18

19 Minimum Scope of Insurance Additional insured on General Liability and Auto Current, valid insurance certificates with 30-days cancellation notice Insurers Best Rating of no less than A:VII Amend policies & certs: Your interest is primary & other ins excess Severability of interest (ins applies to each insured) Failure to comply with reporting provisions will not affect coverage 19

20 Additional Insured Provision Appointed officers, members, employees and volunteers are included as insureds with regard to damages and defense of claims arising from: a) Activities performed by or on behalf of the Named Insured b) Products and completed operations of the Named Insured c) Premises owned, leased or used by the Named Insured d) The ownership, operation, maintenance, use, loading or unloading of any auto 20

21 Insurance Provisions Define Insurance Requirements Coverage types, terms, formats Timeframes for maintaining coverage Limits, per occurrence and aggregate Financial stability of insurer Additional insured status, endorsements and certificates Put Requirements in RFPs / Contracts 21

22 Contractual Risk Transfer Factors to Consider Control of the Risk Knowledge of the Risk Statutory or Common Law Limitations Custom & Practice Bargaining Position Will it pass public policy scrutiny? 22

23 Cyber Liability 23

24 Data Breaches Data Breaches / Millions of Records Exposed Millions # Data Breaches # Records Exposed (Millions) 24

25 Worldwide Cybersecurity Spending F ($ Billions) $85 $ % $80 $75 $70 $65 $60 $55 $ % $60.0 $ % 7.9% $71.1 $ % Cybersecurity spending increased by an estimated $5.2B in 2014, $5.8B in 2015 and $6.3B in % 10% 8% 6% 4% 2% $ F 2015F 2016F Worldwide Cybersecurity Spending % Change from Previous Year 0% 25

26 What Risks can be Transferred Buying insurance Breach response costs/crisis management costs Regulatory investigations, civil fines and penalties (where insurable by law) Litigation from individuals / class actions Litigation from financial institutions and other third parties Media liability libel, slander, intellectual property infringement damages and expenses Cyber Extortion consultant costs, ransom payments Data asset loss & non physical business interruption Loss of business income & extra expense 26

27 Available Coverages Exposure Category Network Security Liability Privacy Liability Regulatory Liability Legal / Notification Expense Description Provides liability coverage if an Insured's Computer System fails to prevent a Security Breach or a Privacy Breach Provides liability coverage if an Insured fails to protect electronic or non-electronic information in their care custody and control Coverage for lawsuits or investigations by Federal, State, or Foreign regulators relating to Privacy Laws 1st Party expenses to comply with Privacy Law notification requirements Crisis Management Credit Monitoring Expense Forensic Investigations Public Relations 1st Party expenses to provide up to 12 months credit monitoring 1st Party expenses to investigate a system intrusion into an Insured Computer System 1st Party expenses to hire a Public Relations firm Data Recovery Business Interruption Cyber Extortion Technology Services/Products & Professional Errors & Omission Liability Media Liability 1st party expenses to recover data damaged on an Insured Computer System as a result of a Failure of Security 1st party expenses for lost income from an interruption to an Insured Computer System as a result of a Failure of Security Payments made to a party threatening to attack an Insured's Computer System in order to avert a cyber attack Technology Products & Services and Miscellaneous E&O can be added to a policy when applicable Covers the Insured for Intellectual Property and Personal Injury perils the result from an error or omission in content (coverage for Patent and Trade Secrets are generally not provided) 27

28 Assessing Cyber Risk What do you need Ponemon Studies: Cost per Record cost per record

29 Assessing Cyber Risk What records do you have? 400 Breach Cost per Record by Industry Cost per Record

30 Assessing Cyber Risk Which line are you? 30 Trends in Breach Cost ($M) by Co. Size Small Medum Large X-Large

31 Thank You Thomas Douglas Area Vice President Arthur J. Gallagher & Co Powerscourt Dr. Suite 500 St. Louis, MO